CVE-2026-1321: WordPress Membership Plugin Escalation Flaw

CVE-2026-1321 Overview

The Membership Plugin – Restrict Content plugin for WordPress contains a critical Privilege Escalation vulnerability affecting all versions up to and including 3.2.20. This vulnerability allows unauthenticated attackers to register with any membership level, including inactive levels that grant privileged WordPress roles such as Administrator, or paid levels that charge a sign-up fee.

Critical Impact

Unauthenticated attackers can bypass membership level validation to gain Administrator access or register for paid membership tiers without payment, leading to complete site compromise or financial loss.

Affected Products

• Membership Plugin – Restrict Content plugin for WordPress versions up to and including 3.2.20
• Partially patched in version 3.2.18, but full remediation requires version 3.2.21 or later

Discovery Timeline

• 2026-03-05 - CVE CVE-2026-1321 published to NVD
• 2026-03-05 - Last updated in NVD database

Technical Details for CVE-2026-1321

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization). The rcp_setup_registration_init() function processes user registration requests without properly validating the membership level specified in the rcp_level POST parameter. The function accepts any membership level ID without checking whether the level is currently active or whether payment is required for that level.

The secondary component of this vulnerability involves the add_user_role() method, which assigns the WordPress role configured on the membership level without performing any status checks. This creates a dangerous chain where an attacker can specify any membership level—including disabled premium tiers configured to grant Administrator roles—and receive the associated WordPress privileges upon registration.

The attack is particularly dangerous because many WordPress sites configure high-privilege membership levels for internal or testing purposes and deactivate them, assuming inactive levels cannot be accessed. This assumption is incorrect with vulnerable versions of this plugin.

Root Cause

The root cause is missing authorization checks in the registration flow. The rcp_setup_registration_init() function blindly trusts the rcp_level POST parameter value without validating:

1. Whether the specified membership level is currently marked as active
2. Whether payment is required and has been successfully processed
3. Whether the membership level exists and is valid for public registration

The add_user_role() method compounds this issue by assigning WordPress roles based solely on the membership level configuration, without verifying the membership's payment or activation status.

Attack Vector

An unauthenticated attacker can exploit this vulnerability via network-based attacks against the WordPress registration endpoint. The attacker submits a crafted POST request to the registration handler with a manipulated rcp_level parameter pointing to a membership level configured with Administrator privileges.

The attack flow involves: (1) identifying the target site uses the Restrict Content plugin, (2) enumerating or guessing membership level IDs, (3) submitting a registration request with the privileged membership level ID, and (4) gaining the WordPress role associated with that membership level without proper authentication or payment.

For technical details on the vulnerable code paths, refer to the WordPress Registration Functions Reference and the RCP Registration Class.

Detection Methods for CVE-2026-1321

Indicators of Compromise

• Unexpected user registrations with Administrator or other privileged roles
• User accounts created with premium membership levels that have no associated payment records
• Registration activity associated with inactive or disabled membership levels
• Suspicious POST requests to registration endpoints containing manipulated rcp_level parameters

Detection Strategies

• Monitor WordPress user creation events for accounts with Administrator privileges that lack corresponding admin creation logs
• Review membership database tables for memberships created without payment transaction records
• Implement web application firewall (WAF) rules to detect unusual rcp_level parameter values in registration requests
• Audit user accounts created since the plugin was installed for unauthorized privilege assignments

Monitoring Recommendations

• Enable detailed logging for all WordPress user registration and role assignment events
• Configure alerts for new Administrator account creation outside of normal administrative workflows
• Monitor the wp_usermeta table for role changes associated with new user registrations
• Review RCP membership logs for registrations to inactive or premium membership levels without payments

How to Mitigate CVE-2026-1321

Immediate Actions Required

• Update the Membership Plugin – Restrict Content plugin to version 3.2.21 or later immediately
• Audit all user accounts created since installing vulnerable versions for unauthorized privileges
• Review and remove any Administrator accounts that were not intentionally created
• Temporarily disable user registration if patching cannot be performed immediately

Patch Information

The vulnerability was partially patched in version 3.2.18 and fully addressed in subsequent releases. Two changesets address this vulnerability: Changeset #3447187 and Changeset #3460177. Site administrators should update to the latest available version to ensure complete remediation. Additional details are available in the Wordfence Vulnerability Report.

Workarounds

• Disable public user registration on the WordPress site until the patch is applied
• Review all membership levels and ensure none grant Administrator or Editor roles
• Implement WAF rules to block registration requests with unexpected rcp_level parameter values
• Remove or deactivate any membership levels configured with privileged WordPress roles

# Disable WordPress user registration via wp-config.php as temporary mitigation
# Add this line to wp-config.php before the line "That's all, stop editing!"
define('DISALLOW_FILE_EDIT', true);

# Alternatively, use WP-CLI to disable registration
wp option update users_can_register 0